ace-hitl 0.17.0 → 0.23.2

data/lib/ace/hitl/cli/commands/overseer_pending.rb

@@ -1,28 +0,0 @@
-# frozen_string_literal: true
-
-require "ace/support/cli"
-require_relative "lifecycle_command"
-
-module Ace
-  module Hitl
-    module CLI
-      module Commands
-        # Host-broker drain view of the Overseer response outbox.
-        class OverseerPending < Ace::Support::Cli::Command
-          include Ace::Support::Cli::Base
-          include LifecycleCommand
-
-          desc "List queued Overseer responses (host-broker operation)"
-
-          option :quiet, type: :boolean, aliases: %w[-q], desc: "Suppress non-essential output"
-
-          def call(**options)
-            emit(overseer.pending)
-          rescue Lifecycle::Error => e
-            raise_lifecycle_error(e.message)
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/hitl/cli/commands/overseer_send.rb

@@ -1,35 +0,0 @@
-# frozen_string_literal: true
-
-require "ace/support/cli"
-require_relative "lifecycle_command"
-
-module Ace
-  module Hitl
-    module CLI
-      module Commands
-        # The Root Overseer's bounded, type-tagged response through the
-        # reverse address (spec 8wm.t.y21 §6). The response is read from
-        # stdin.
-        class OverseerSend < Ace::Support::Cli::Command
-          include Ace::Support::Cli::Base
-          include LifecycleCommand
-
-          desc "Queue a bounded, type-tagged Overseer response (stdin)"
-
-          option :"reply-to", type: :string, desc: "Source message id this response answers"
-
-          option :quiet, type: :boolean, aliases: %w[-q], desc: "Suppress non-essential output"
-
-          def call(**options)
-            emit(overseer.send_response(
-              reply_to: options[:"reply-to"] || "",
-              reader: LifecycleCommand::STDIN_READER
-            ))
-          rescue Lifecycle::Error => e
-            raise_lifecycle_error(e.message)
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/hitl/cli/commands/proposal.rb

@@ -1,75 +0,0 @@
-# frozen_string_literal: true
-
-require "ace/support/cli"
-require_relative "lifecycle_command"
-require_relative "../../proposals/evaluator"
-
-module Ace
-  module Hitl
-    module CLI
-      module Commands
-        class Proposal < Ace::Support::Cli::Command
-          include Ace::Support::Cli::Base
-          include LifecycleCommand
-          argument :operation, required: true, desc: "create, show, revise, history or resolve-due"
-          argument :id, required: false, desc: "Exact proposal ID"
-          option :assignment, type: :string
-          option :attempt, type: :string
-          option :project, type: :string
-          option :file, type: :string
-          option :"expected-revision", type: :integer, desc: "Exact source revision for revise"
-          option :"operation-id", type: :string, desc: "Caller-persisted revision- plus 24 lowercase hex digits"
-          option :format, type: :string, default: "json"
-          option :now, type: :string, desc: "Unavailable in production; inject a fixture clock in tests"
-          option :"history-after", type: :integer, desc: "Read the next bounded history page from history_next"
-          option :query, type: :string, desc: "Relevant prior decisions containing this text"
-          option :after, type: :string, desc: "History-list cursor from next"
-
-          def call(operation:, id: nil, **options)
-            raise_lifecycle_error("only --format json is supported") unless options[:format] == "json"
-            raise_lifecycle_error("--now is restricted to injected test fixtures; production uses trusted UTC clock") if options[:now]
-            result = case operation
-            when "create"
-              %i[assignment attempt project].each { |key| raise_lifecycle_error("--#{key} required") if options[key].to_s.empty? }
-              raise_lifecycle_error("stable proposal ID required") if id.to_s.empty?
-              lifecycle_client.proposal_create(id: id, assignment: options[:assignment], attempt: options[:attempt],
-                project: options[:project], document: load_document(options[:file]))
-            when "show"
-              raise_lifecycle_error("proposal ID required") if id.to_s.empty?
-              raise_lifecycle_error("--project required") if options[:project].to_s.empty?
-              lifecycle_client.proposal_show(id, project: options[:project], history_after: options[:"history-after"] || 0)
-            when "revise"
-              raise_lifecycle_error("proposal ID required") if id.to_s.empty?
-              raise_lifecycle_error("--expected-revision required") unless options[:"expected-revision"]
-              raise_lifecycle_error("--operation-id required") if options[:"operation-id"].to_s.empty?
-              raise_lifecycle_error("--project required") if options[:project].to_s.empty?
-              lifecycle_client.proposal_revise(id, project: options[:project], expected_revision: options[:"expected-revision"],
-                operation_id: options[:"operation-id"], document: load_document(options[:file]))
-            when "resolve-due"
-              raise_lifecycle_error("--project required") if options[:project].to_s.empty?
-              Proposals::Evaluator.new(boundary: lifecycle_client, project: options[:project]).call
-            when "history"
-              raise_lifecycle_error("--project required") if options[:project].to_s.empty?
-              lifecycle_client.proposal_history(project: options[:project], query: options[:query] || "", after: options[:after])
-            else raise_lifecycle_error("choose create, show, revise, history or resolve-due")
-            end
-            emit(result)
-          rescue Lifecycle::Error, Providers::ProviderUnavailableError => e
-            raise_lifecycle_error(e.message)
-          end
-
-          private
-
-          def load_document(path)
-            raise_lifecycle_error("--file required") if path.to_s.empty?
-            content = File.open(path, "rb") { |file| file.read(4097) }
-            raise_lifecycle_error("proposal file exceeds 4096 bytes") if content.bytesize > 4096
-            JSON.parse(content)
-          rescue JSON::ParserError, SystemCallError
-            raise_lifecycle_error("proposal file must be readable JSON")
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/hitl/lifecycle/overseer.rb

@@ -1,111 +0,0 @@
-# frozen_string_literal: true
-
-require "securerandom"
-require_relative "errors"
-require_relative "identity"
-require_relative "atomic_json"
-require_relative "kinds"
-
-module Ace
-  module Hitl
-    module Lifecycle
-      # The Root Overseer's bounded response channel — the reverse
-      # address of the HITL conversation (spec 8wm.t.y21 §6; ports of
-      # overseer-send/overseer-pending/overseer-ack). Responses are
-      # bounded, type-tagged, and free of internal identifiers; the
-      # transport that relays them is NOT part of this surface.
-      class Overseer
-        MAX_RESPONSE = 1200
-        TYPE_TAGS = %w[[decyzja] [pytanie] [info]].freeze
-        TYPE_TAG = /\A\[(decyzja|pytanie|info)\]/i
-
-        FULL_SHA = /\b[0-9a-fA-F]{40,64}\b/
-        ATTEMPT_REFERENCE = /\bA-[0-9a-fA-F]{24}\b/
-        WORK_REFERENCE = /\bW[0-9]{3,}\b/
-        TASK_REFERENCE = /\b[0-9a-z]{3,}\.t\.[0-9a-z.]+\b/i
-        SHA_WORD = /\bSHA(?:-?256)?\b/i
-
-        attr_reader :outbox_dir
-
-        def initialize(outbox_dir:, overseer_user: "mo", ownership: AtomicJson::DEFAULT_OWNERSHIP,
-          identity: Identity)
-          @outbox_dir = Pathname.new(outbox_dir)
-          @overseer_user = overseer_user
-          @ownership = ownership
-          @identity = identity
-        end
-
-        # Queue one bounded, type-tagged response (read from the reader,
-        # e.g. stdin). Only the overseer user may respond.
-        def send_response(reader:, reply_to: "")
-          unless @identity.username == @overseer_user
-            raise PermissionError, "only the Root Overseer can send channel responses"
-          end
-          reply_to = reply_to.to_s
-          if !reply_to.empty? && (!/\A\d+\z/.match?(reply_to) || reply_to.length > 32)
-            raise StateError, "invalid source message id"
-          end
-
-          response = reader.call(MAX_RESPONSE + 1).to_s.strip
-          if response.empty? || response.length > MAX_RESPONSE || response.include?("\u0000")
-            raise StateError, "response must contain 1-#{MAX_RESPONSE} characters"
-          end
-          unless TYPE_TAG.match?(response)
-            raise StateError,
-              "response must open with a type tag: #{TYPE_TAGS.join(", ")}"
-          end
-          if FULL_SHA.match?(response) || ATTEMPT_REFERENCE.match?(response) ||
-              WORK_REFERENCE.match?(response) || TASK_REFERENCE.match?(response) ||
-              SHA_WORD.match?(response)
-            raise StateError,
-              "rewrite for Captain without SHA, Work/Attempt/task IDs, hashes, or internal references"
-          end
-
-          message_id = "msg-#{SecureRandom.hex(8)}"
-          value = {
-            "id" => message_id,
-            "reply_to_message_id" => reply_to,
-            "response" => response,
-            "created_at" => Time.now.to_i,
-            "requester" => @overseer_user
-          }
-          AtomicJson.call(@outbox_dir.join("#{message_id}.json"), value, mode: 0o600, ownership_strategy: @ownership)
-          response.clear
-          {
-            "id" => message_id,
-            "queued" => true,
-            "reply_to_message_id" => reply_to
-          }
-        end
-
-        # Root-only drain view of the outbox.
-        def pending
-          require_root!("overseer-pending")
-          @outbox_dir.glob("*.json").sort.filter_map { |path| AtomicJson.read(path) }
-        end
-
-        # Root-only acknowledgement: the transport removes one response
-        # exactly once it has been relayed.
-        def ack(message_id)
-          require_root!("overseer-ack")
-          id = message_id.to_s
-          raise StateError, "invalid message id" unless Kinds::REQUEST_ID.match?(id)
-
-          path = @outbox_dir.join("#{id}.json")
-          raise StateError, "unknown Overseer response" unless path.exist?
-
-          path.unlink
-          {"id" => id, "acknowledged" => true}
-        end
-
-        private
-
-        def require_root!(operation)
-          unless @identity.root?
-            raise Lifecycle::PermissionError, "#{operation} is a host-broker operation"
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/hitl/lifecycle/proposals.rb

@@ -1,297 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "../proposals/policy"
-
-module Ace
-  module Hitl
-    module Lifecycle
-      module Proposals
-        def proposal_create(id:, assignment:, attempt:, project:, document:)
-          require_proposer!(project)
-          content = Ace::Hitl::Proposals::Policy.document(document)
-          unless id.is_a?(String) && id.match?(/\Aproposal-[0-9a-f]{24}\z/)
-            raise StateError, "create requires a stable proposal ID"
-          end
-          existing = proposal_journal(project).proposal_record(id)
-          if existing && existing.values_at("assignment_id", "attempt_id", "project_id", "requester", "caller_uid", "content_digest") !=
-              [assignment, attempt, project, @identity.username, @identity.uid, Digest::SHA256.hexdigest(JSON.generate(content))]
-            raise StateError, "proposal retry changed immutable content or caller"
-          end
-          proposal_revision(id, 1, assignment: assignment, attempt: attempt, project: project, content: content)
-        end
-
-        def proposal_revise(id, project:, expected_revision:, operation_id:, document:)
-          old = proposal_access!(id, project: project, requester: true)
-          require_proposer!(old["project_id"])
-          unless expected_revision.is_a?(Integer) && expected_revision.positive? &&
-              operation_id.is_a?(String) && operation_id.match?(/\Arevision-[0-9a-f]{24}\z/)
-            raise StateError, "revise requires an expected source revision and stable revision operation ID"
-          end
-          content = Ace::Hitl::Proposals::Policy.document(document)
-          replay = proposal_revision_replay(id, expected_revision, operation_id, content, project: project)
-          if replay
-            project_proposal_request(replay)
-            return replay
-          end
-          proposal_revision(id, expected_revision + 1, assignment: old["assignment_id"],
-            attempt: old["attempt_id"], project: old["project_id"], content: content,
-            expected_revision: expected_revision, operation_id: operation_id)
-        rescue Ace::Assign::AttemptErrors::ReceiptRejected => e
-          raise StateError, "Proposal revision refused (#{e.message})"
-        end
-
-        def proposal_show(id, project:, history_after: 0)
-          record = proposal_access!(id, project: project)
-          unless history_after.is_a?(Integer) && history_after >= 0
-            raise StateError, "history cursor must be a non-negative offset"
-          end
-          history = proposal_journal(project).proposal_history(id)
-          entries = (history.slice(history_after, 3) || []).map do |entry|
-            outcome = proposal_journal(project).proposal_claims(entry["revision_id"]).last
-            entry.merge("actual_outcome" => outcome && outcome["state"],
-              "effect_request_id" => outcome && outcome["request_id"])
-          end
-          claims = proposal_journal(project).proposal_claims(record["revision_id"])
-          claim = claims.last
-          outcome = case claim && claim["state"]
-          when "pending" then "queued"
-          when "accepted" then "executing"
-          when "succeeded" then "succeeded"
-          when "failed", "failed-settled", "rejected" then "failed"
-          when "uncertain" then "uncertain"
-          end
-          record.merge("state" => outcome || record["state"], "decision_state" => record["state"],
-            "effect_claim" => claim, "history" => entries, "history_count" => history.length,
-            "history_next" => history_after + entries.length < history.length ? history_after + entries.length : nil)
-        end
-
-        def proposal_acknowledge(request, project:, submitted_at:)
-          record = proposal_for_request!(request, project: project)
-          require_transport!("proposal delivery", {"project" => record["project_id"]})
-          proposal_transition(record) { |current| Ace::Hitl::Proposals::Policy.acknowledge(current, submitted_at) }
-        end
-
-        def proposal_reply(request, project:, answer:, received_at:, sequence:)
-          record = proposal_for_request!(request, project: project)
-          require_transport!("proposal reply", {"project" => record["project_id"]})
-          proposal_transition(record) do |current|
-            # Claims and this transition share one canonical ref lock/CAS.
-            claimed = proposal_journal(project).proposal_claims(current["revision_id"]).any?
-            applied = proposal_journal(project).proposal_history(current["proposal_id"]).find do |entry|
-              entry["revision_id"] == current["revision_id"] && entry["reply_sequence"] == sequence
-            end
-            Ace::Hitl::Proposals::Policy.reply(current, applied: applied, answer: answer, received_at: received_at,
-              sequence: sequence, claimed: claimed)
-          end
-        end
-
-        def proposal_reconcile(request, project:, checkpoint:)
-          record = proposal_for_request!(request, project: project)
-          require_transport!("proposal reconciliation", {"project" => record["project_id"]})
-          proposal_transition(record) do |current|
-            next current unless silence_delegated?(current)
-            Ace::Hitl::Proposals::Policy.resolve(current, checkpoint: checkpoint, now: proposal_now)
-          end
-        end
-
-        def proposal_wake(project:, after: nil)
-          raise StateError, "invalid proposal wake project" unless project.is_a?(String) && Kinds::SAFE_LABEL.match?(project)
-          require_proposer!(project)
-          records = proposal_journal(project).proposals.sort_by { |record| record["proposal_id"] }.select do |record|
-            record["project_id"] == project && (!after || record["proposal_id"] > after) &&
-              record["state"] == "awaiting-decision" && record["deadline"] <= proposal_now
-          end
-          selected = records.first(8)
-          items = selected.map do |record|
-            proposal_transition(record) { |current| current["reconcile_requested_at"] ? current : current.merge("reconcile_requested_at" => proposal_now) }
-            {"proposal_id" => record["proposal_id"], "status" => "queued-for-transport"}
-          end
-          {"items" => items, "next" => records.length > 8 ? selected.last["proposal_id"] : nil}
-        end
-
-        def proposal_due(project:, after: nil)
-          require_transport!("proposal deadlines", {"project" => project})
-          records = proposal_journal(project).proposals.sort_by { |record| record["proposal_id"] }.select do |record|
-            record["project_id"] == project && (!after || record["proposal_id"] > after) &&
-              @policy.transport?(@identity, project: record["project_id"]) &&
-              record["state"] == "awaiting-decision" && record["deadline"] <= proposal_now && record["reconcile_requested_at"]
-          end
-          selected = records.first(8)
-          {"items" => selected.map { |record| record.slice("proposal_id", "request_id", "deadline") },
-           "next" => records.length > 8 ? selected.last["proposal_id"] : nil}
-        end
-
-        def proposal_history(project:, query: "", after: nil)
-          unless query.is_a?(String) && query.bytesize <= 240 && project.is_a?(String)
-            raise StateError, "history requires a project and bounded query"
-          end
-          records = proposal_journal(project).proposals.sort_by { |record| record["proposal_id"] }.select do |record|
-            next false unless record["project_id"] == project && (!after || record["proposal_id"] > after)
-            visible = (record["requester"] == @identity.username && record["caller_uid"] == @identity.uid &&
-              @policy.respond_to?(:proposal?) && @policy.proposal?(@identity, project: project)) ||
-              @policy.transport?(@identity, project: project)
-            visible && (query.empty? || JSON.generate(record.slice("operation", "target", "context", "recommendation")).downcase.include?(query.downcase))
-          end
-          selected = records.first(3)
-          {"items" => selected, "next" => records.length > 3 ? selected.last["proposal_id"] : nil}
-        end
-
-        private
-
-        def silence_delegated?(record)
-          @policy.proposal_silence?(caller_uid: record["caller_uid"], requester: record["requester"],
-            project: record["project_id"], operation: record["operation"])
-        end
-
-        def require_proposer!(project)
-          unless @policy.respond_to?(:proposal?) && @policy.proposal?(@identity, project: project)
-            raise PermissionError, "proposal requires the installed second-commander decision principal"
-          end
-        end
-
-        def proposal_now
-          @proposal_clock.call.utc.iso8601
-        end
-
-        def proposal_journal(project)
-          unless project.is_a?(String) && Kinds::SAFE_LABEL.match?(project)
-            raise StateError, "proposal requires an explicit project"
-          end
-          @binding.proposal_journal(project: project)
-        rescue NoMethodError
-          raise BindingError, "Managed proposal authority is unavailable"
-        end
-
-        def proposal_access!(id, project:, requester: false)
-          unless id.is_a?(String) && id.match?(/\Aproposal-[0-9a-f]{24}\z/)
-            raise StateError, "invalid proposal ID"
-          end
-          record = proposal_journal(project).proposal_record(id)
-          raise StateError, "unknown proposal" unless record && record["project_id"] == project
-          if record["requester"] == @identity.username && record["caller_uid"] == @identity.uid &&
-              @policy.respond_to?(:proposal?) && @policy.proposal?(@identity, project: record["project_id"])
-            return record
-          end
-          if record["requester"] != @identity.username || record["caller_uid"] != @identity.uid
-            raise PermissionError, "only proposal requester may revise" if requester
-            require_transport!("proposal read", {"project" => record["project_id"]})
-          else
-            raise PermissionError, "proposal read requires current project authority" if requester
-            require_transport!("proposal read", {"project" => record["project_id"]})
-          end
-          record
-        end
-
-        def proposal_for_request!(request, project:)
-          unless request.is_a?(String) && request.match?(/\Aproposal-[0-9a-f]{24}-r[1-9][0-9]*\z/)
-            raise StateError, "invalid proposal revision request"
-          end
-          id = request.sub(/-r[1-9][0-9]*\z/, "")
-          proposal_access!(id, project: project)
-          record = proposal_journal(project).proposal_history(id).reverse.find { |entry| entry["request_id"] == request }
-          raise StateError, "unknown proposal revision" unless record
-          record
-        end
-
-        def proposal_transition(record, &policy)
-          proposal_journal(record.fetch("project_id")).change_proposal(record["proposal_id"], assignment_id: record["assignment_id"],
-            attempt_id: record["attempt_id"]) do |current|
-            # Selection may change while waiting for the canonical ref lock.
-            proposal_journal(record.fetch("project_id"))
-            # A reply to an older revision cannot modify the new decision.
-            next current unless current["request_id"] == record["request_id"]
-            policy.call(current)
-          end
-        rescue Ace::Assign::Error => e
-          raise StateError, "Proposal transition refused (#{e.message})"
-        end
-
-        def proposal_revision(id, revision, assignment:, attempt:, project:, content:, expected_revision: nil, operation_id: nil)
-          request = "#{id}-r#{revision}"
-          question = "Proposal #{request}: #{JSON.generate(content)}"
-          replay = nil
-          record = @binding.with_active(assignment: assignment, attempt: attempt, project: project, requester: @identity.username) do
-            proposal_journal(project).change_proposal(id, assignment_id: assignment, attempt_id: attempt) do |previous|
-              proposal_journal(project)
-              if operation_id
-                replay = proposal_revision_replay(id, expected_revision, operation_id, content, project: project)
-                next previous if replay
-                unless previous && previous["revision"] == expected_revision
-                  raise StateError, "proposal source revision changed concurrently"
-                end
-              end
-              if previous && previous["revision"] == revision
-                unless previous.values_at("assignment_id", "attempt_id", "project_id", "requester", "caller_uid", "content_digest") ==
-                    [assignment, attempt, project, @identity.username, @identity.uid, Digest::SHA256.hexdigest(JSON.generate(content))]
-                  raise StateError, "proposal retry changed immutable content or caller"
-                end
-                next previous
-              end
-              unless (revision == 1 && previous.nil?) ||
-                  (operation_id && previous && previous["revision"] == expected_revision)
-                raise StateError, "proposal revision changed concurrently"
-              end
-              projection = prepare_request(id: request, assignment: assignment, attempt: attempt, project: project,
-                kind: "proposal", plan: "second commander exact proposal", question: question, ace_hitl_id: id)
-              content.merge("schema" => "ace.hitl.proposal/v1", "proposal_id" => id, "revision" => revision,
-                "revision_id" => request, "request_id" => request, "assignment_id" => assignment,
-                "attempt_id" => attempt, "project_id" => project, "requester" => @identity.username,
-                "caller_uid" => @identity.uid, "content_digest" => Digest::SHA256.hexdigest(JSON.generate(content)),
-                "state" => "awaiting-delivery", "created_at" => proposal_now,
-                "silence_delegated" => @policy.proposal_silence?(caller_uid: @identity.uid,
-                  requester: @identity.username, project: project, operation: content.fetch("operation")),
-                "authorization" => request, "lifecycle_request" => projection).tap do |value|
-                  if operation_id
-                    value["revision_operation_id"] = operation_id
-                    value["expected_source_revision"] = expected_revision
-                  end
-                end
-            end
-          end
-          record = replay || record
-          project_proposal_request(record)
-          record
-        end
-
-        def proposal_revision_replay(id, expected_revision, operation_id, content, project:)
-          replay = proposal_journal(project).proposal_operation_record(operation_id)
-          return unless replay
-          unless replay.values_at("proposal_id", "project_id", "expected_source_revision", "requester", "caller_uid", "content_digest") ==
-              [id, project, expected_revision, @identity.username, @identity.uid, Digest::SHA256.hexdigest(JSON.generate(content))]
-            raise StateError, "revision retry changed immutable source, content or caller"
-          end
-          replay
-        end
-
-        def project_proposal_request(record)
-          value = record.fetch("lifecycle_request")
-          if request_path(value.fetch("id")).exist?
-            unless load_request(value.fetch("id")) == value
-              raise StateError, "canonical proposal projection differs from lifecycle request"
-            end
-            initialize_projection!(value)
-          else
-            begin
-              persist_request(value)
-            rescue StateError => e
-              raise unless e.message == "HITL request already exists" && load_request(value.fetch("id")) == value
-              initialize_projection!(value)
-            end
-          end
-        end
-
-        def recover_proposal_projections(project:)
-          return unless @binding.respond_to?(:proposal_journal)
-          selected_projects = project ? [project] : @binding.proposal_projects
-          selected_projects.each do |selected|
-            next unless @policy.transport?(@identity, project: selected)
-            proposal_journal(selected).proposals.each do |record|
-              next unless record["project_id"] == selected
-              project_proposal_request(record)
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/hitl/lifecycle/service_publication_binding.rb

@@ -1,97 +0,0 @@
-# frozen_string_literal: true
-require_relative "binding"
-require "json"
-
-module Ace
-  module Hitl
-    module Lifecycle
-      # Constructed beside the same-process authority, never from wire data.
-      # The selector is routing data; only the authority's held callback can
-      # admit a store transition for the original receiver process.
-      class ServicePublicationBinding < Binding
-        FIELDS = %w[schema mapping_id assignment_id attempt_id request_id claim_binding input_digest
-          candidate_generation head challenge_digest].freeze
-
-        def initialize(ordinary:, authority:, kernel:)
-          @ordinary, @authority, @kernel = ordinary, authority, kernel
-        end
-
-        def validate_request(**params)
-          deny_executor_ordinary!(params.fetch(:project), params[:caller_pid])
-          @ordinary.validate_request(**params)
-        end
-
-        def reverse_address(**params)
-          @ordinary.reverse_address(**params)
-        end
-
-        def with_active(**params, &block)
-          @ordinary.with_active(**params, &block)
-        end
-
-        def proposal_journal(project:)
-          @ordinary.proposal_journal(project: project)
-        end
-
-        def proposal_projects
-          @ordinary.proposal_projects
-        end
-
-        def with_publication!(binding:, identity:, assignment:, attempt:, project:, otp:, original_peer: nil, requester_required: true)
-          unless binding.is_a?(Hash) && binding.keys.sort == FIELDS.sort &&
-              binding["schema"] == "ace.hitl-publication-binding/v1" &&
-              binding["assignment_id"] == assignment && binding["attempt_id"] == attempt &&
-              %w[mapping_id assignment_id attempt_id request_id].all? { |key| binding[key].is_a?(String) && binding[key].match?(/\A[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}\z/) } &&
-              %w[claim_binding input_digest challenge_digest].all? { |key| binding[key].is_a?(String) && binding[key].match?(/\A[0-9a-f]{64}\z/) } &&
-              binding["head"].is_a?(String) && binding["head"].match?(/\A[0-9a-f]{40}\z/) &&
-              binding["candidate_generation"].is_a?(Integer) && binding["candidate_generation"].positive? &&
-              otp.is_a?(Hash) && otp["operation"] == "publish" && otp["input_digest"] == binding["input_digest"]
-            raise BindingError, "publication HITL selector differs"
-          end
-          caller = requester_required ? actual_peer!(identity) : original_peer
-          raise BindingError, "publication original receiver differs" if original_peer && caller != original_peer
-          @authority.with_publication_hitl!(binding: binding, project: project, peer: caller) do |selection|
-            unless selection.fetch("challenge_ref") == otp["result_ref"] && selection.fetch("executor_process_binding") == caller
-              raise BindingError, "publication challenge or receiver differs"
-            end
-            yield selection
-          end
-        rescue Ace::Assign::Error, Ace::Runtime::RuntimeUnavailableError => e
-          raise BindingError, "publication authority unavailable (#{e.class.name})"
-        end
-
-        def verify_publication_requester!(identity:, original_peer:)
-          raise BindingError, "publication original receiver differs" unless actual_peer!(identity) == original_peer
-          true
-        end
-
-        private
-
-        def actual_peer!(identity)
-          unless identity.respond_to?(:pid) && identity.pid.is_a?(Integer) && identity.pid.positive?
-            raise BindingError, "publication kernel peer is unavailable"
-          end
-          peer = @kernel.capture(identity.pid)
-          unless peer["uid"] == identity.uid && peer["gid"] == identity.gid
-            raise BindingError, "publication kernel credentials differ"
-          end
-          @kernel.live!(peer)
-          peer
-        end
-
-        def deny_executor_ordinary!(project, pid)
-          unless pid.is_a?(Integer) && pid.positive?
-            raise BindingError, "HITL kernel requester is unavailable"
-          end
-          peer = @kernel.capture(pid)
-          @kernel.live!(peer)
-          if @authority.publication_executor_identity?(project: project, uid: peer.fetch("uid"))
-            raise BindingError, "executor cannot select an ordinary worker HITL request"
-          end
-        rescue Ace::Assign::Error, Ace::Runtime::RuntimeUnavailableError => error
-          raise BindingError, "HITL kernel requester unavailable (#{error.class.name})"
-        end
-      end
-    end
-  end
-end